Question 1

What does 'entropy' mean exactly?

Accepted Answer

Entropy in bits measures unpredictability. Each bit doubles the number of guesses needed: 40 bits = 1 trillion guesses, 60 bits = quadrillion, 80+ bits is what experts recommend for important accounts. We compute it from password length × log2(character set size).

Question 2

Length or complexity — which matters more?

Accepted Answer

Length wins. Adding one character to a 12-character password roughly multiplies crack time by the size of your character set (e.g. 95×). Adding one symbol type only multiplies it once. 'correct horse battery staple' (28 chars) beats 'P@ss1!' (6 chars) by trillions of times.

Question 3

Why does 'P@ssw0rd!' rate weak even with all character types?

Accepted Answer

Because attackers use dictionary attacks with common substitutions (a→@, o→0, s→$). 'Password' is in every leaked-password list ever made; adding predictable mutations doesn't help. Real entropy comes from unpredictable choices, not formulaic edits.

Question 4

Is my password sent to check against breach databases?

Accepted Answer

No. All scoring runs locally in your browser. We never transmit the password. If you want to check breach exposure, use Have I Been Pwned's k-anonymity API, which only sends the first 5 characters of the password's SHA-1 hash.

Question 5

What's a 'good enough' score?

Accepted Answer

Aim for crack time of centuries against an offline attack. That's roughly 70+ bits of entropy. For non-critical sites, 50 bits is acceptable; for banking, email, or your password manager master, target 80+ bits and use a unique password.

Password Strength Checker

Frequently Asked Questions

Explore More Tools

Hash Generator

AES Encrypt / Decrypt

TOTP Authenticator

Hash Compare